Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

38,662 results · page 224 of 774

Sep 15, 2025The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection.CVE-2025-59361 · Other software · Chaos-mesh · reported by reefs@jfrog.comCritical 9.8
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Product
Chaos Mesh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com jfrog.com
Sep 15, 2025The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection.CVE-2025-59360 · Other software · Chaos-mesh · reported by reefs@jfrog.comCritical 9.8
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Product
Chaos Mesh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com jfrog.com
Sep 15, 2025The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection.CVE-2025-59359 · Other software · Chaos-mesh · reported by reefs@jfrog.comCritical 9.8
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Product
Chaos Mesh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com jfrog.com
Sep 14, 2025Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and deleteCVE-2025-10452 · Other software · Gotac · reported by twcert@cert.org.twCritical 9.3
Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level privileges.
Product
Statistical Database System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 12, 2025Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combinatCVE-2025-45583 · Other software · Audi · reported by MITRECritical 9.1
Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combination of username and password.
Product
Universal Traffic Recorder Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 2barbie.notion.site
Sep 12, 2025Flowise is a drag & drop user interface to build a customized large language model flow.CVE-2025-58434 · Other software · FlowiseAI · reported by GitHubCritical 9.8
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and
Product
Flowise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 12, 2025OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free.CVE-2024-45434 · Other software · Opensynergy · reported by MITRECritical 9.8
OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of validating the existence of an object before performing operations on the object (aka use after free). An attacker can leverage this to achieve remote code execution in the context of a user account under which the Bluetooth process runs.
Product
Blue SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pcacybersecurity.com opensynergy.com
Sep 12, 2025File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering.CVE-2025-55835 · Other software · Sueamcms Project · reported by MITRECritical 9.8
File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering.
Product
Sueamcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 12, 2025Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3.CVE-2025-9556 · Other software · Langchaingo · reported by cret@cert.orgCritical 9.8
Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a statement into a prompt to read the "etc/passwd" file.
Product
Langchaingo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 12, 2025The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application.CVE-2025-10365 · Other software · Evertz · reported by research@onekey.comCritical 9.3
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.
Product
3080ipx-10G
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record onekey.com
Sep 12, 2025The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application.CVE-2025-10364 · Other software · Evertz · reported by research@onekey.comCritical 9.3
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.
Product
3080ipx-10G
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record onekey.com
Sep 12, 2025Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards.CVE-2025-8699 · Other software · KioSoft · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.1
Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By carefully observing changes in card dumps, one can identify fields that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the cash and an unknown field with a certain value. By updating the fields accordingly, arbitrary amounts of money can be loaded onto the card (up to $655,35) to pay for goods.
Product
Stored Value Unattended Payment Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com seclists.org
Sep 12, 2025NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, moCVE-2025-10266 · Other software · NewType Infortech · reported by twcert@cert.org.twCritical 9.3
NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
NUP Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 12, 2025Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the sysCVE-2025-10264 · Other software · Digiever · reported by twcert@cert.org.twCritical 10
Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.
Product
DS-1200
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Sep 11, 2025AIRI is a self-hosted, artificial intelligence based Grok Companion.CVE-2025-59053 · Other software · moeru-ai · reported by GitHubCritical 9.6
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the `packages/stage-ui/src/components/MarkdownRenderer.vue` path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An attacker creates a card file containing malicious HTML/JavaScript, then simply processes it using the highlightTagToHtml function (which simply replaces template tags without HTML escaping), and then directly renders it using v-html, leading to cross-site scripting (XSS). The project also exposes the Tauri API, which can be called from the frontend. The MCP plugin exposes a command execution interface function in `crates/tauri-plugin-mcp/src/lib.rs`. This allows arbitrary command execution. `connect_server` directly passes the user-supplied `command` and `args` parameters to `Command::new(command).args(args)` without any input validation or whitelisting. Thus, the previous XSS exploit could achieve command execution through this interface. v0.7.2-beta.3 fixes the issue.
Product
airi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 11, 2025In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 (CVE-2025-39758 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, size_t size) [...] /* Calculate the number of bytes we need to push, for this page * specifically */ size_t bytes = min_t(size_t, PAGE_SIZE - offset, size); /* If we can't splice it, then copy it in, as normal */ if (!sendpage_ok(page[i])) msg.msg_flags &= ~MSG_SPLICE_PAGES; /* Set the bvec pointing to the page, with len $bytes */ bvec_set_page(&bvec, page[i], bytes, offset); /* Set the iter to $size, aka the size of the whole sendpages (!!!) */ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size); try_page_again: lock_sock(sk); /* Sendmsg with $size size (!!!) */ rv = tcp_sendmsg_locked(sk, &msg, size); This means we've been sending oversized iov_iters and tcp_sendmsg calls for a while. This has a been a benign bug because sendpage_ok() alwa
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 11, 2025[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues relaCVE-2025-58143 · Other software · Xen · reported by security@xen.orgCritical 9.8
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.
Product
Xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xenbits.xenproject.org openwall.com
Sep 11, 2025[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues relaCVE-2025-58142 · Other software · Xen · reported by security@xen.orgCritical 9.8
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.
Product
Xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xenbits.xenproject.org openwall.com
Sep 11, 2025[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues relaCVE-2025-27466 · Other software · Xen · reported by security@xen.orgCritical 9.8
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.
Product
Xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xenbits.xenproject.org openwall.com
Sep 11, 2025Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.CVE-2025-58321 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 10
Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.
Product
DIALink
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record filecenter.deltaww.com
Sep 11, 2025BeyondCart Connector: Privilege EscalationCVE-2025-8570 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
Product
BeyondCart Connector
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update BeyondCart Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 10, 2025Hoverfly is an open source API simulation tool.CVE-2025-54123 · Other software · SpectoLabs · reported by GitHubCritical 9.8
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the s
Product
hoverfly
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 10, 2025Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allowCVE-2025-10226 · Other software · AxxonSoft · reported by 15ede60e-6fda-426e-be9c-e788f151a377Critical 9.3
Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4.
Product
AxxonOne C-Werk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axxonsoft.com postgresql.org
Sep 10, 2025Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remoCVE-2025-10220 · Other software · AxxonSoft · reported by 15ede60e-6fda-426e-be9c-e788f151a377Critical 9.3
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others.
Product
AxxonOne C-Werk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axxonsoft.com
Sep 10, 2025An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is cCVE-2025-9943 · Other software · Shibboleth · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.1
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.
Product
Service Provider
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com shibboleth.net
Sep 9, 2025The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name oCVE-2025-59046 · Other software · ninofiliu · reported by GitHubCritical 9.8
The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.
Product
interactive-git-checkout
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats.CVE-2025-59039 · Other software · prebid · reported by GitHubCritical 9.3
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
Product
prebid-universal-creative
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sonatype.com
Sep 9, 2025rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server.CVE-2025-58448 · Other software · rathena · reported by GitHubCritical 9.1
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.
Product
rathena
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server.CVE-2025-58447 · Other software · rathena · reported by GitHubCritical 9.8
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.
Product
rathena
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025DeepChat is a smart assistant uses artificial intelligence.CVE-2025-58768 · Other software · ThinkInAIXYZ · reported by GitHubCritical 9.6
DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering component, there is a risky operation of directly using `innerHTML` to set user content. Therefore, any malicious content rendered via Mermaid will directly trigger the exploit chain, leading to command execution. This vulnerability is primarily caused by a failure to fully address the existing XSS issue in the project, leading to another exploit chain. The exploit chain is consistent with the report GHSA-hqr4-4gfc-5p2j, executing arbitrary JavaScript code via XSS and arbitrary commands via exposed IPC. Version 0.3.5 contains an updated fix.
Product
deepchat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 9, 2025OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx.CVE-2025-58462 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.
Product
FOIAXpress Public Access Link (PAL)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.opexustech.com github.com
Sep 9, 2025A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands.CVE-2025-57633 · Other software · reported by MITRECritical 9.8
A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html endpoint's "Upload File" action constructs a shell command from the ftp_file parameter and executes it using os.system() without sanitization or escaping.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Sep 9, 2025An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmwareCVE-2025-10159 · Network & remote access · Sophos · reported by security-alert@sophos.comCritical 9.8
An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7).
Product
AP6 Series Wireless Access Points
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sophos.com
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58762 · Other software · Tautulli · reported by GitHubCritical 9.1
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when combined with the `Script` notification agent. If an attacker with administrative access changes the URL of the PMS to a server they control, they can then abuse the `pms_image_proxy` to obtain a file write into the application filesystem. This can be done by making a `pms_image_proxy` request with a URL in the `img` parameter and the desired file name in the `img_format` parameter. Tautulli then uses a hash of the desired metadata together with the `img_format` in order to construct a file path. Since the attacker controls `img_format` which occupies the end of the file path, and `img_format` is not sanitised, the attacker can then use path traversal characters to specify filename of their choosing. If the specified file does not exist, Tautaulli will then attempt to fetch the image from the configured PMS. Since the attacker controls the PMS, they can return arbitrary content in response
Product
Tautulli
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.CVE-2025-44594 · Other software · Halo · reported by MITRECritical 9.1
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
Product
Halo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record meadow-horn-b94.notion.site
Sep 9, 2025XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.CVE-2025-55730 · Other software · xwikisas · reported by GitHubCritical 10
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for any user who can edit any page. The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 has a fix for the issue.
Product
xwiki-pro-macros
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.CVE-2025-55729 · Other software · xwikisas · reported by GitHubCritical 10
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 has a fix for the issue.
Product
xwiki-pro-macros
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.CVE-2025-55728 · Other software · xwikisas · reported by GitHubCritical 10
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue.
Product
xwiki-pro-macros
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.CVE-2025-55727 · Other software · xwikisas · reported by GitHubCritical 10
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any user who can edit any page or who can access the CKEditor converter. The width parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution when the macro has been installed by a user with programming right, or it at least allows executing Velocity code as the wiki admin. Version 1.26.5 contains a patch for the issue.
Product
xwiki-pro-macros
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025CWE-1392: Use of Default CredentialsCVE-2025-55051 · Other software · Baicells · reported by cna@cyber.gov.ilCritical 10
CWE-1392: Use of Default Credentials
Product
NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il
Sep 9, 2025CWE-1242: Inclusion of Undocumented FeaturesCVE-2025-55050 · Other software · Baicells · reported by cna@cyber.gov.ilCritical 9.8
CWE-1242: Inclusion of Undocumented Features
Product
NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il
Sep 9, 2025Use of Default Cryptographic Key (CWE-1394)CVE-2025-55049 · Other software · Baicells · reported by cna@cyber.gov.ilCritical 9.1
Use of Default Cryptographic Key (CWE-1394)
Product
NEUTRINO430
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il
Sep 9, 2025Multiple CWE-78CVE-2025-55048 · Other software · Baicells · reported by cna@cyber.gov.ilCritical 9.8
Multiple CWE-78
Product
NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il
Sep 9, 2025Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function.CVE-2025-57085 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Product
W30e Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2025Mow: Cross-Site Request Forgery (CSRF)CVE-2025-58997 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through <= 4.10.
Product
Mow
Affected
up to 4.10
What to do
Affects up to 4.10. Update Mow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.CVE-2025-55232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.
Product
Microsoft HPC Pack 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Sep 9, 2025ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulneCVE-2025-54261 · Websites & servers · Adobe · reported by AdobeCritical 10
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.
Product
ColdFusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Sep 9, 2025Photography: Deserialization of Untrusted DataCVE-2025-47579 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.
Product
Photography
Affected
up to 7.7.2
What to do
Affects up to 7.7.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025WooCommerce Ultimate Gift Card: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47569 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through <= 2.9.6.
Product
WooCommerce Ultimate Gift Card
Affected
up to 2.9.6
What to do
Affects up to 2.9.6. Update WooCommerce Ultimate Gift Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Material Dashboard: Weak Password Recovery Mechanism for Forgotten PasswordCVE-2025-32486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.
Product
Material Dashboard
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.